TOFU

[Peter Lebbing]

On 23/06/17 03:07, MFPA wrote:
> I thought "good signature" just meant the message has not been
> altered in transit.

That's very well possible. In that case there is no verbal indication of
a valid signature, only a colour. The text I see for a signature by a
fully valid key is:

Good signature from First Name Last Name <mail at example.org>
Key ID: 0xXXXXXXXX / Signed 0n: DD/MM/YY HH:MM

And this is with a green background. There is no verbal indication that
the signing key is valid, unlike the version with the blue background,
where the text is:

UNTRUSTED Good signature from First Name Last Name <mail at example.org>
Key ID: 0xXXXXXXXX / Signed 0n: DD/MM/YY HH:MM

So this does verbally indicate invalidity.


Anyway, apart from what the developers /meant/ when they wrote it, it's
about how people interpret it. And I got the impression that Stefan
thought that "UNTRUSTED Good signature" had some positive conotation,
something saying this signature gave more validity to the message than
if it were not signed. But that's not what it means, it's a signature by
an invalid key. Anybody can make a signature by an invalid key. The only
thing "good" means here is that the message was not altered *after* it
was signed by that invalid key. But who made the signature...

When you say "not altered in transit", that would very much depend on
your definition of "in transit". If a Man in the Middle changes both the
text and the signature, I'd say it /was/ altered in transit. But it was
altered in such a way that it once again has an "UNTRUSTED Good"
signature, by a different (attacker-controlled) key.

So IMO, "good" doesn't even mean "not altered in transit", as you said.

Otherwise we could keep redefining "in transit" ad absurdum, and finally
claim that "in transit" means when the video card sent the signal to the
monitor, when the light hit my retinas, when the nerves excited my brain
cells... ;-P.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20170623/1c45f184/attachment.sig>